Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×
Desktop Security
security advisory vulnerability
security advisory vulnerability GNOME is officially shortening its standard vulnerability disclosure window from 90 days to 30 days, a change that impacts upstream maintainers, downstream Linux distributions, and system administrators in how they handle software vulnerabilities. The policy shift, announced by long-time security coordinator Michael Catanzaro , addresses modern software patching realities and a growing influx of automated submissions. . Because GNOME is the default desktop environment on several major Linux...
Jul 21, 2026
Security Vulnerabilities security advisory moderate
security advisory moderate For organizations that run a self-hosted Git platform, it’s no longer just about hosting static code repositories. Today, Git servers are responsible for deployment pipelines, API tokens, SSH keys, package repositories, and the automation scripts that push code directly. Confirm that the upgrade addresses known vulnerabilities but also provides production environments. . That makes them trusted systems within the development environment and attractive targets for attackers looking to move...
Jul 20, 2026
Server Securitydata privacy automation
data privacy automation Every system admin has lived through the same Monday morning ritual. A queue of forty tickets, half of them password resets, permission errors, or disk space warnings that any experienced technician could resolve in under two minutes. The other half require actual judgment. For years, automation promised that software would eventually sort the two apart on its own. That promise is now being tested in production Linux environments. . Early results are reshaping how IT teams think about tier-1...
Jul 17, 2026
Privacydata collection automation
data collection automation You're running a web scraping project to collect pricing data from e-commerce sites. You set up a pool of datacenter proxies, launch your scripts, and within minutes — banned . CAPTCHAs everywhere. Your data pipeline stops before it really begins. . It's a frustrating scenario that plays out daily in ad verification, market research, and multi-account management. The website doesn't know you're doing legitimate research or monitoring. It just sees traffic coming from IP ranges it recognizes as...
Jul 17, 2026
Security Trends security advisory social engineering
security advisory social engineering Business Email Compromise used to be a numbers game — mass-blasted emails, broken English, an obvious "URGENT WIRE TRANSFER" subject line. That era is over. Generative AI has turned BEC into a tailored, low-noise operation that mimics writing style, voice, and even video presence. This piece looks at what's actually changed under the hood, what defenders are testing in response, and why so many organizations are still structurally unprepared for it. . The Infrastructure Problem Nobody Wants to...
Jul 17, 2026
Refine news
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Loading...
Explore Latest Linux Security news
We found 23 articles for you...
212
malware threatsystem administrationcloud securityTeamTNT Docker Assault: Mitigating Risks with Effective Security Strategies
TeamTNT has recently emerged at the forefront of the ever-evolving threat landscape by devising novel exploits assaulting Docker clusters. Their Docker Gatling Gun campaign has targeted 16 million IP addresses worldwide and attacked Docker clusters globally. . To help you understand and prepare for this emerging threat, I'll investigate its nature, attack flow, impact, and targets, providing system administrators with actionable insights to protect against this campaign and other Linux container security threats. Understanding This Docker Security Threat TeamTNT, widely recognized in the hacking community, has made headlines again by engaging in an unprecedented attack against cloud-native infrastructures. By exploiting exposed Docker daemons, this group systematically deploys Sliver malware, a multi-faceted cyber worm, and crypto miners through compromised servers and Docker Hub to perpetuate their spread while renting out computational resources to third parties for direct crypto mining operations. Their devious yet malevolent campaign uses native cloud capabilities by employing Docker Swarm E xpansion capabilities while using Docker Hub to distribute Sliver malware. Decoding the Attack Flow TeamTNT Gutling Gun Attack Flow (source: aquasec) TeamTNT's campaign showcases an intricately planned attack flow, with the following key components observed over seven years: External and Local Lateral Movement: Malware infections can be quickly deployed within an organization's network by employing tools like Masscan and ZGrab to deploy them quickly on related servers within its environment. Local network probing also plays a vital role in spreading infections quickly across servers within it. Resource Hijacking: This aspect primarily centers on crypto miner deployment and, more surprisingly, the sale of compromised infrastructure for computational resource stripping purposes, relieving mining operations, and maintaining operations independently. Commandand Control (C2): By employing Sliver malware as a significant barrier against counterintelligence efforts, TeamTNT has upped their game by potentially adding Tsunami functionality into their strategy. Cloud Tool Exploitation: Docker Hub has been used for malware storage and distribution, while Sliver provided command and control (C2) and exploit capability. Initial attacks involve exploiting Docker daemons on specific ports, laying the foundation for an advanced "Docker Gatling Gun" script which scans for vulnerable instances to create an extensive target range and, upon success, deploys an Alpine Linux image with malicious commands from TeamTNT's Docker Hub account. Sliver Malware Explodes to New Heights TeamTNT has swapped its previously utilized backdoor utility Tsunami for more subtle Sliver malware. This open-source tool enables dynamic C2 operations across various protocols while remaining undetectable due to its per-binary asymmetric encryption keys explicitly compiled for each binary encryption key used. TeamTNT can utilize Sliver malware to direct commands, execute payloads, and introduce in-memory execution capabilities. Through its exploits, TeamTNT poses a severe threat to cloud-native landscapes. This group's attacks silently spread across cloud infrastructures by seizing Docker clusters. Using Docker Swarm extends its reach and ensures persistent presence as crypto miners sap computational resources from victims, showing its devastating potential. Who Is at Risk? Its Docker cluster operators with exposed daemons are primary targets in this campaign. This can encompass businesses and organizations using cloud services or open-source cloud software—especially those operating operational baselines and open-source entities in the cloud environment. However, due to indications of potential future Kubernetes cluster exploitations, the net at risk can expand further; virtually any organization using containerized environments without taking stringent security precautionsis also at risk. Practical Strategies to Help Sysadmins Reduce Risk Protecting Docker clusters against such malignant threats requires a proactive and multi-layered approach including the following best practices: Port Security: For best practice, ensure that Docker daemon ports (2375, 2376, 4243, and 4244) do not expose themselves directly to the public internet. Instead, bind them directly to localhost or utilize VPN technology to access Docker environments. Secure Docker API endpoints: Set up mutual TLS authentication and implement encrypted communication for data protection while in transit. Monitor and Analyze Network Traffic: Regularly monitor for unusual network activity patterns that could indicate an attack script or illegal Docker images being pulled from registries. Maintain Docker and its Dependencies Regularly: To protect against vulnerabilities that attackers could exploit, it is recommended that Docker and all its dependencies be regularly updated and patched for optimal performance and to reduce vulnerabilities that malware could exploit. Access Controls: To limit the number of users who can push or pull images from Docker registries and environments, role-based access control (RBAC) should be applied. Secure Container Images: Before deployment, always utilize reliable base images and scan for vulnerabilities before rejecting those that do not pass security checks. Limit Resource Usage: Set restrictions on Docker containers to minimize potential gains from crypto miner deployment while monitoring for abnormal resource consumption patterns. Incident Response Plan: Develop an incident response plan so you can take quick, decisive action if your system becomes compromised. For example, you could isolate infected containers and servers and conduct a full forensic investigation. Backup and Recovery: Keep backup copies of crucial data and system configurations on hand to ensure fast recovery in case of security incidents. Education and Training: Provide all team members with training on this form of attack and ensure all operators use container operations judiciously while adhering to best practices for Docker security. Identity Threat Detection and Response (ITDR) What is ITDR? Have you thought about some of the ways we can block these types of attacks? Identity Threat Detection and Response (ITDR) is all about keeping a close eye on who is accessing your systems and ensuring they're supposed to be there. Imagine it as a vigilant security team dedicated to tracking user activities and catching any suspicious behavior that might indicate someone is trying to gain unauthorized access. With ITDR, you'll have tools that continuously monitor what users are doing, look for unusual patterns that could signal a threat, and enforce strong security measures like multi-factor authentication to make sure only the right people get in. If something fishy does happen, ITDR systems can jump into action automatically, alerting your team and taking steps to minimize any potential damage. In short, ITDR helps keep your digital environment safe by focusing intensely on the security of user identities. Check out ModSecurity for Apache. It's a bit complicated to use, but it's an open source web application firewall (WAF) that can also be configured to monitor and respond to potential identity threats happening through web applications. It includes real-time monitoring and logging of HTTP traffic, a rule-based detection system, and the ability to block suspicious activities and mitigate attacks against Apache. Our Final Thoughts on Combating This Container Security Threat Administrators can take proactive measures against TeamTNT and other threat actors by employing these measures, strengthening their cloud environments against any unauthorized exploitation and potential malware campaigns. Security is an ongoing priority for us admins, particularly given cloud technologies' increasing role in business operations and threatactors like TeamTNT becoming ever more sophisticated. Therefore, administrators must remain vigilant and implement robust measures to safeguard against potential breaches. . Grasp the implications of TeamTNT's latest attacks on Docker environments and explore strategies to safeguard your infrastructures from this advancing danger.. TeamTNT Malware, Docker Security Threat, Container Exploitation, Cloud Infrastructure Safety, Cybersecurity Practices. . Anthony Pell
Oct 29, 2024
•
Cloud Security
83
security advisorymalware threatmalwareQNAP: Dovecat Malware Threatens NAS Security with High CPU Use
The Dovecat Monero-mining malware doesn't steal data, but it consumes large amounts of CPU and memory. This is the latest threat faced by QNAP customers - after research published in July 2020 identified that tens of thousands of NAS drives are potentially vulnerable to malware that prevents administrators from applying patches. . QNAP has warned its customers that their network-attached storage (NAS) drives might be susceptible to infection by a malware strain known as Dovecat, which infects devices and silently mines cryptocurrency . The firm has issued a security advisory warning its users about Dovecat, which might infect NAS devices when they’re connected to the internet with weak passwords, according to QNAP’s analysis. . QNAP warns users regarding Dovecat malware, which compromises their NAS systems by causing excessive CPU load while illicitly mining cryptocurrency.. Dovecat Malware, NAS Security, Cryptocurrency Threats, QNAP Security Advisory. . LinuxSecurity.com Team
Jan 25, 2021
•
Hacks/Cracks
210
security advisorycritical issuemalware threatExploring Major Security Threats Affecting IT Systems In The Last Decade
Thank you to Skynats for contributing this article. This past decade has been plagued with security vulnerabilities. Let’s have a look at the top vulnerabilities that have recently crippled the IT world. Badlock: Badock is a crucial security bug affecting Windows computers and Samba servers. It is identified using the following reference: (CVE-2016-0128(Microsoft) CVE-2016-2118(samba). The RPC services allowed an attacker to become a man in the middle to intercept the communication between a client and a server hosting a SAM database to exploit and force the authentication to downgrade, allowing the attackers to access the SAM database. Blueborne: Blueborne is a virus that spreads through the air. Yes, it of course through the Bluetooth on your device. Everything from your smartphone to other devices (TV, Computer, smart cars, laptops) are Bluetooth enabled and active almost all the time, leaving these devices vulnerable to malware attacks that can remotely seize them without user permission. Cloud Bleed: This was another leading cloud-based security vulnerability affecting Cloudflare's reverse proxies which was discovered on February 17, 2017. Most of the busiest websites and the apps rely on Cloudflare's protection. This security bug caused their edge server to run past the end of a buffer and then return the memory which contained private information such as: 1. HTTP cookies 2. Authentication tokens 3. HTTP post bodies 4. Tons of sensitive data and more The worst part was that some of this data was cached by search engines. Dirty Cow: This was another serious security problem discovered in the way the Linux kernel memory handled the copy on write (COW) that affects Linux-based OSes including Android devices that used an older version (before 2018) of the Linux kernel. Dirty Cow is a local privilege escalation vulnerability bug that exploits a rare condition by implementing the copy on write mechanism. Computers and devices that still using an older version of theLinux kernel remain vulnerable, and any user can become root in less than five seconds. The exploitation of this bug doesn't leave any trace in the log, so you can't detect if someone has used this exploit against your server. Foreshadow: This bug (L1TF or foreshadow) affecting Intel/AMD processors will allow attackers unprecedented access to sensitive information that is stored on a personal computers and cloud server. Foreshadow has two versions: the original attack which extracts data from SGX enclaves and the second version (next-generation) which targets virtual machines (VMs), hypervisors (VMM), OS Kernel memory and system management mode (SMM) memory. Foreshadow is similar to the Spectre security bug which affects the Intel and AMD chips, and the Meltdown security bug also affects Intel. Nevertheless, applying software patches may help mitigate some concern, but the users may see some considerable changes in overall PC or server power by doing so. Heartbleed: Heartbleed is a serious vulnerability in the popular open SSL cryptographic software library, used widely in implementation of the transport layer security (TLS) protocol. The Heartbleed vulnerability was publicly disclosed in April of 2014. iSee You: This is an Apple webcam vulnerability which is a silent malware attack. Apple laptops affected are capable of running all sort of operating systems, including macOS, Microsoft Windows and Linux. Researchers have released iSightDefender, a macOS kernel extension to reduce the attack surface under the macOS operating system. KRACK: (Key Reinstallation Attack) is a replay attack (a type of exploitable flaw) on the Wi-Fi protected Access protocol (WPA) used to secure the Wi-Fi connections. It was discovered in 2016 by Belgian researchers. All the major software platforms that use Wi-Fi protected access are affectedincluding Microsoft windows, macOS, iOS, Linux, Andriod and OpenBSD. Lazy: Lazy, which is also referred to as Lazy FP State Restore or LazyFP, is a securityvulnerability affecting Intel CPUs. The vulnerability is caused by a combination of flaws in the speculation execution technology. This vulnerability is used to leak the content of the FPU registers that belongs to another process. Lazy is related to the Spectre and Meltdown vulnerabilities which were publicly disclosed in January of 2018. Linux .encoder: This is considered to be the first ransomware Trojan targeting computers and cloud servers running Linux. There are additional variants of this Trojan that target other UNIX and UNIX-like systems which were discovered on November 5, 2015. Meltdown: Meltdown is a severe security vulnerability in tech media that is found in almost all CPUs used in modern devices. Mobile phones, laptops, systems and internet of things (IoT) devices are vulnerable. Meltdown CPU vulnerabilities and exposures will break the fundamental isolation between the user and the application. This will allows a rogue process to access the memory of other programs and the operating system. The Meltdown vulnerabilities primarily affect Intel microprocessors, but will also affect the ARM Cortex-A75 and IBM's Power microprocessors. It does not affect AMD CPUs. Microarchitectural: The Microarchitectural Data Sampling (MDS) vulnerabilities are a set of weaknesses in Intel x86 microprocessors that use hyper-threading to leak data across the protection boundaries that are architecturally supposed to be secure. After Meltdown, Spectre and Foreshadow, Microarchitectural is considered the most critical vulnerability in modern processors. The attack exploits vulnerabilities have been labeled as Fallout, RIDL (rogue in-flight Data load) and Zombiaload and allows attackers to steal sensitive data and keys. Have another vulnerability that you feel belongs on this list? Please do not hesitate to reach out and let us know! . . Thank you to Skynats for contributing this article. This past decade has been plagued with security . thank, skynats, contributing, article, decade, plagued,security. . Brittany Day
Jan 14, 2021
•
Security Vulnerabilities
210
security advisorymalware threatdata exfiltrationZoom: Researcher Mazin Ahmed Exposes Multiple Vulnerabilities at DEF CON 28
Security researcher Mazin Ahmed demonstrated multiple serious vulnerabilities in the popular Zoom app, two of which impact Linux users, at DEF CON 28. . Popular video conferencing app Zoom has addressed several security vulnerabilities, two of which affect its Linux client that could have allowed an attacker with access to a compromised system to read and exfiltrate Zoom user data—and even run stealthy malware as a sub-process of a trusted application. According to cybersecurity researcher Mazin Ahmed , who presented his findings at DEF CON 2020 yesterday, the company also left a misconfigured development instance exposed that wasn't updated since September 2019, indicating the server could be susceptible to flaws that were left unpatched. The link for this article located at The Hacker News is no longer available. . Zoom has tackled significant security issues, notably within its Linux application, as pointed out by analyst Mazin Ahmed.. Zoom Security Issues, Linux Data Exfiltration, DEF CON 28 Vulnerabilities, Malware Threats, Research Findings. . Brittany Day
Aug 10, 2020
•
Security Vulnerabilities
83
malware threatsecurity breachdata leakSHEIN: Major Security Breach Exposes Customer Passwords and Emails
Women’s fashion retailer SHEIN has suffered a major security breach that has exposed the personal information and passwords of over six million customers. . In a press statement, SHEIN reveals that it discovered on August 22 2018 that malicious hackers had compromised its computer network, and that between June and early August 2018 customer email addresses and “encrypted password credentials” had been stolen. The link for this article located at Hot for Security is no longer available. . In a press statement, SHEIN reveals that it discovered on August 22 2018 that malicious hackers had . women’s, fashion, retailer, shein, suffered, major, security, breach, exposed, personal. . LinuxSecurity.com Team
Sep 26, 2018
•
Hacks/Cracks
83
malware threatcybersecuritycyber attackFBI Alert: Sony Megahack Malware Risks Impacting US Businesses
The FBI has warned US businesses to maintain a heightened state of alert following a high profile cyber attack on Sony Pictures Entertainment last week. . The malicious software outlined in the alert bears the hallmarks of the malware that affected Sony. Reuters reports that the five-page, confidential "flash" warning was issued by the FBI on Monday. The link for this article located at The Register UK is no longer available. . The CIA warns American firms about the recent Target data breach and associated cyber risks they should be aware of.. Sony Hack, Malware Threats, FBI Warning, Cybersecurity, Business Security. . LinuxSecurity.com Team
Dec 02, 2014
•
Hacks/Cracks
83
data breachmalware threatcyber threatExploring The Risks Of CRM Data Breaches In Retail Security
It is clear why malware writers target TGT -0.1% such retailers as Home Depot HD -0.43% and Target. It is obvious, if not pathetic, why hackers break into the cloud to find and publish private nude photos of celebrities. But a company. Even the CRM systems that don The link for this article located at Forbes is no longer available. . Explore the dangers that cybercriminals present to CRM datasets and the escalating hazard it signifies for retail safety and consumer confidentiality.. CRM Security Risks, Data Breach Threats, Retail Cybersecurity, Malware Attacks. . LinuxSecurity.com Team
Sep 15, 2014
•
Hacks/Cracks
67
malware threatssl bypassfinancial theftUnderstanding the Risks of Dyreza Trojan SSL Bypass in Online Banking
Banker Trojans have proven to be reliable and effective tools for attackers interested in quietly stealing large amounts of money from unwitting victims. Zeus, Carberp and many others have made piles of money for their creators and the attackers who use them, and researchers have been looking at a newer banker Trojan that has the ability to bypass SSL protection for banking sessions by redirecting traffic through the attackers. The Trojan, which is being called either Dyre or Dyreza by researchers, uses a technique known as browser hooking to intercept traffic flowing between the victim The link for this article located at ThreatPost is no longer available. . The Dyreza Trojan highlights advanced cyberattack tactics, notably bypassing SSL encryption to commit financial crimes, endangering online banking security.. Dyreza Trojan, Browser Hooking, SSL Security Threats, Financial Cybercrime, Online Banking Threats. . LinuxSecurity.com Team
Jun 18, 2014
•
Cryptography
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Trending News
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!